EUVD-2026-64334

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

EUVD-2026-64336

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...

CVE-2026-62388

NLTK (Python Natural Language Processing toolkit) versions before 3.10.0 ship with an insecure default in pathsec.py : the ENFORCE flag is set to False, causing all security validation functions to emit warnings rather than raising exceptions. This means path traversal and pickle deserialization ...